Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "=?UTF-8?q?Christian=20K=C3=B6nig?=" 
        <ckoenig.leichtzumerken@gmail.com>
To:     linux-kernel@vger.kernel.org, linux-unionfs@vger.kernel.org,
        codalist@coda.cs.cmu.edu, dri-devel@lists.freedesktop.org
Cc:     jaharkes@cs.cmu.edu, coda@cs.cmu.edu, miklos@szeredi.hu,
        akpm@linux-foundation.org, jgg@ziepe.ca
Subject: [PATCH 2/2] ovl: fix reference counting in ovl_mmap error path
Date:   Wed, 21 Apr 2021 15:20:12 +0200
Message-Id: <20210421132012.82354-2-christian.koenig@amd.com>
In-Reply-To: <20210421132012.82354-1-christian.koenig@amd.com>
References: <20210421132012.82354-1-christian.koenig@amd.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

mmap_region() now calls fput() on the vma->vm_file.

Fix this by using vma_set_file() so it doesn't need to be
handled manually here any more.

Signed-off-by: Christian König <christian.koenig@amd.com>
Fixes: 1527f926fd04 ("mm: mmap: fix fput in error path v2")
CC: stable@vger.kernel.org # 5.11+
---
 fs/overlayfs/file.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index dbfb35fb0ff7..3847cdc069b5 100644
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -430,20 +430,11 @@ static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
 	if (WARN_ON(file != vma->vm_file))
 		return -EIO;
 
-	vma->vm_file = get_file(realfile);
+	vma_set_file(vma, realfile);
 
 	old_cred = ovl_override_creds(file_inode(file)->i_sb);
 	ret = call_mmap(vma->vm_file, vma);
 	revert_creds(old_cred);
-
-	if (ret) {
-		/* Drop reference count from new vm_file value */
-		fput(realfile);
-	} else {
-		/* Drop reference count from previous vm_file value */
-		fput(file);
-	}
-
 	ovl_file_accessed(file);
 
 	return ret;
-- 
2.25.1